UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

media: atomisp: Fix a buffer overflow in debug code 

The "pad" variable is a user controlled string and we haven't properly
clamped it at this point so the debug code could print from beyond the
of the array.

Fixes: a49d25364d ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
This commit is contained in:
Dan Carpenter 2020-11-20 17:27:18 +01:00 committed by Mauro Carvalho Chehab
parent 7072db8957
commit 625993166b
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/staging/media/atomisp/pci/atomisp_subdev.c
View File

@ -349,12 +349,20 @@ static int isp_subdev_get_selection(struct v4l2_subdev *sd,
return 0;
}
static char *atomisp_pad_str[] = { "ATOMISP_SUBDEV_PAD_SINK",
"ATOMISP_SUBDEV_PAD_SOURCE_CAPTURE",
"ATOMISP_SUBDEV_PAD_SOURCE_VF",
"ATOMISP_SUBDEV_PAD_SOURCE_PREVIEW",
"ATOMISP_SUBDEV_PAD_SOURCE_VIDEO"
};
static const char *atomisp_pad_str(unsigned int pad)
{
static const char *const pad_str[] = {
"ATOMISP_SUBDEV_PAD_SINK",
"ATOMISP_SUBDEV_PAD_SOURCE_CAPTURE",
"ATOMISP_SUBDEV_PAD_SOURCE_VF",
"ATOMISP_SUBDEV_PAD_SOURCE_PREVIEW",
"ATOMISP_SUBDEV_PAD_SOURCE_VIDEO",
};
if (pad >= ARRAY_SIZE(pad_str))
return "ATOMISP_INVALID_PAD";
return pad_str[pad];
}
int atomisp_subdev_set_selection(struct v4l2_subdev *sd,
struct v4l2_subdev_pad_config *cfg,
@ -378,7 +386,7 @@ int atomisp_subdev_set_selection(struct v4l2_subdev *sd,
dev_dbg(isp->dev,
"sel: pad %s tgt %s l %d t %d w %d h %d which %s f 0x%8.8x\n",
atomisp_pad_str[pad], target == V4L2_SEL_TGT_CROP
atomisp_pad_str(pad), target == V4L2_SEL_TGT_CROP
? "V4L2_SEL_TGT_CROP" : "V4L2_SEL_TGT_COMPOSE",
r->left, r->top, r->width, r->height,
which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"
@ -612,7 +620,7 @@ void atomisp_subdev_set_ffmt(struct v4l2_subdev *sd,
enum atomisp_input_stream_id stream_id;
dev_dbg(isp->dev, "ffmt: pad %s w %d h %d code 0x%8.8x which %s\n",
atomisp_pad_str[pad], ffmt->width, ffmt->height, ffmt->code,
atomisp_pad_str(pad), ffmt->width, ffmt->height, ffmt->code,
which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"
: "V4L2_SUBDEV_FORMAT_ACTIVE");